Session Hijacking Vulnerability in Charging Station Software by Mobiliti

CVE-2026-27764

What is CVE-2026-27764?

The WebSocket backend in Mobiliti's charging station software exposes a significant vulnerability due to the use of charging station identifiers for session management. This flawed implementation permits multiple endpoints to utilize the same session identifier, which in turn creates predictable session identifiers. Consequently, this may allow attackers to hijack legitimate sessions, thus enabling unauthorized users to interact with backend commands intended for a specific charging station. Moreover, malicious entities might exploit this weakness to initiate a denial-of-service condition by bombarding the backend with valid session requests, leading to interruptions in normal service.

References